Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS13Njd2LXBoNHgtZjQ4cc4AA6p_

Mattermost Server Improper Access Control

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

Permalink: https://github.com/advisories/GHSA-w67v-ph4x-f48q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Njd2LXBoNHgtZjQ4cc4AA6p_
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 8 months ago
Updated: 4 months ago


CVSS Score: 4.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Identifiers: GHSA-w67v-ph4x-f48q, CVE-2024-29221
References: Repository: https://github.com/mattermost/mattermost
Blast Radius: 0.0

Affected Packages

go:github.com/mattermost/mattermost/server/v8
Dependent packages: 2
Dependent repositories: 1
Downloads:
Affected Version Ranges: >= 9.3.0, < 9.3.3, >= 9.4.0, < 9.4.4, >= 9.5.0, < 9.5.2, >= 8.1.0, < 8.1.11
Fixed in: 9.3.3, 9.4.4, 9.5.2, 8.1.11
All affected versions:
All unaffected versions: